LibreWolf: A privacy-focused Firefox fork
ubunlog.com
ubunlog.com
* Needing to constantly monitor whether the fork is being actively maintained, or if it's a vanity project which abruptly stops/slows down updates when its owner/principal contributors lose interest.
* Needing to constantly monitor if the fork is using the latest official Firefox builds to make sure that it's also getting the latest security updates.
* Not being readily able to see a complete humanly understandable (meaning not just comparing git versions) list of changes that the fork makes to the official build.
* Not knowing the reputation of the developers behind the fork.
In sum, I basically trust Mozilla more than I do $random_fork_developer, so I use the official build and carry out my own tweaks, but I am always on the look out for more tweaks, which is why I'd appreciate if lists of privacy tweaks custom builds do were more transparently shared.
The two closest build systems I’ve seen to getting it right: Nix (closest) and FreeBSD ports.
I’ll use the i3 window manager as an example. There are plenty of forks of i3 out there (example: adding space between windows, rounded corners, i3bar mods, etc). They’re each packaged and published as separate packages! You can’t compose them even though many of their changes are compatible. This leads to packages like i3-gaps-rounded.
What I really want out of a package manager is “patch support” - where I can publish, discover, share, and consume patches on top of the OSS I use.
Nix gets really close to this. I haven’t invested enough time in learning Nix yet, but it’s on my bucket list. Currently I use FreeBSD and use their ports collection for i3, and put all of my patches in the patch directory there. FreeBSD will apply the patches in order and then build the package for me.
I’m not sure exactly where I’m going with this rant beyond: I wish OSS package management adopted less of a producer-consumer relationship and more of a peer relationship when it comes to source code management and builds.
I would definitely recommend giving Gentoo a spin!
I wasn't that much concerned with it until recently. I got into the idea of the whole "website as app," thing (specifically, client-side you turn a website into a self-contained app, with or without the "sites" permission) -- and to find that Firefox had dropped this is disappointing because it feels well within Firefox's mission.
FWIW, presently I'm solving this through GNOME's Epiphany.
I feel like this is a common thing with forks and alternatives, they usually have a basic list of big differences (like Librewolf with saying it's more private).
But I'd like to know how they do that, are they blocking more cookies? Are they making the browser harder to fingerprint? What am I giving up vs Firefox (ie; sites breaking, or missing features like sync)?
> Firefox security patches are applied to prevent vulnerabilities
You are right about the reputation of the maintainers of LW though. The second this becomes abandonware I will ditch it.
Sure, but at what rate? If Mozilla releases a critical patch today, and the core maintainer responsible for build maintenance is away on vacation for two weeks, what happens?
Timely maintenance is also problematic with hobby closed-source projects or hobby apps on closed platforms, like iOS and Android.
Mozilla gets paid $500m a year by Google so that Google can be default search engine on Firefox. They have the money that keeps them "incentivized" although they are FOSS and nonprofit. Or in another words Gitlab and Github FOSS devs do not have salaries like Mozilla people do, the only thing they get is an occasional donation.
It's great when a fork ensures that it is always taking security patches from upstream. But what about the code unique to the fork? Is that new code following the same security practices as the upstream project? Are enough eyeballs poking at it to get it the same security scrutiny as upstream?
(1) the 'subdivision of the estates' problem that primogeniture solved for inheritance is very well and alive in OSS. If you fork a project often enough most forks will have such a thin developer base, they wither.
(2) this then channels quite a bit of development into projects that will soon die, thus effectively depriving the surviving versions of dev hours.
(3) it's ridiculously complicated for non-technical people to keep up with what project formed from what and which fork is the most current/secure/convenient/otherquality of the bunch.
I am genuinely asking, with all this being known, why hasn't there been a bigger push towards modularity. This was the idea of Unix pipes, and i don't see why it is a bad idea 40+ years later.
Have a 'Gecko' module, have an 'UI' module, have a 'telemetry' module, ..... this would allow people to build Firefox 'flavors' instead of forking everything. Everyone would contribute to the same project/ecosystem, users can discover the big project, and immediately download 'vanilla', but also get info on whatever flavors there are and in what way they differ? What is the real problem here?
Edit: autocorrect-correction
This RPC stuff would likely also be slightly slower, so people would just say Firefox is slow and use Chrome.
Spurious forks are a vector for attack. If your commercial product has FOSS competition, just encourage (finance) two or three forks of it, along the lines of any contentious issues. It's like splitting the opposition vote with fake candidates. It's not necessary for Firefox because it is a completely captured opposition, but it could be happening to other projects.
$500M that Mozilla gets from Google every year.
there's no incentive to develop a better product, only to maintain an appearance of competition.
I don't know if it's a secret agreement or an implicit mutual understanding, but that's what it is. the only alternative explanation I have for Mozilla's actions in the past 8 or so years is incompetence to the degree of profound mental retardation of all decision makers there.
But we were talking about why Mozilla is such a mess (not compared to G, but to its potential). And knowing big Daddy G is the main funding source might just make one a tiny bit suspicious. Just saying.
What you envision about modularity in a small way has already happened with the Skia graphics api. "The library is used as of 2021 in Google Chrome, Chrome OS, Chromium OS, Mozilla Firefox, Mozilla Thunderbird, Android, Firefox OS, LibreOffice (from version 7.0), Flutter and Avalonia (from Alpha 4)."
People are doing this. Brave and Edge are "Chrome flavors". See also https://servo.org/ or the npm and cargo ecosystems.
That said interfaces are incredibly hard to get right. They take an unreasonable amount of work to make and will often end up being unsuitable or obsolete leading to a world of breakage, inefficiency and pain.
One of my favorite features of LibreWolf is truly disabled autoplay. If a site wants to autoplay, you have to allow it first, no exceptions. This might sound petty, but in a world where it feels like you have no control over anything, this small return to feeling like I am allowed to decide what happens in my own damn browser is liberating.
Note that Librewolf doesn’t autoupdate, but you can get notifications when an update is available using an unofficial extension.
https://addons.mozilla.org/en-US/firefox/addon/librewolf-upd...
You can use a package manager to install and update it, too. Even on Windows; it’s available in Winget.
Gonna have to try out librewolf.
Sort of. They require you to dig around in about:config (where settings go to be hidden, then removed) to toggle some obliquely named and unnecessary exception to their autoplay policy, which is if your "gestures" trigger autoplay. This can mean simply mean that you scrolled the page to video was on. The setting to disable autoplay is therefore only reliable on unselected tabs.
Usability is clearly the least important concern for the devs. Mozilla can't make that decision it has to work out of the box.
Of course the most private thing to do is not use computers at all.
In other words, is this truly necessary?
One question. How does website availability fare with all these plugins and options active? Does it mangle or render sites unusable? And at what rate?
On the sites with more heavy tracking —- chegg comes to mind or some different clothing stores with lots of media, payment service scripts, and heavy ad tracking like tentree — the plug-ins definitely interfere to the point where I will sometimes use a second browser so that the website operates as intended. NoScript seems to be the culprit in most cases, and I suspect the interface doesn’t adequately display all the scripts attempting to load after the initial render.
I’ve had some trouble with sites which communicate between themselves too. (Airlines do this a lot).
All in all, I’d say my browsing experience is normal to the extent that I don’t do a lot of browsing to new sites. I’ve got a good running list for noscript, but any new sites with lots of dependencies and media to load usually requires a couple refreshed after an updated rule list.
That said, one has to get used to making those configs every time a new site is browsed (or a previous site changes significantly what it does), but really, for some of us, the experience after the fact is well worth the investment, as browsing and reading become sane again.
I'd expect standard Firefox's protection + popular plugins to be good enough to reduce creepiness of everyday adtech. If you really don't like to be tracked, then the Tor browser may be a better bet. At least you'll look like every other Tor user, rather than stand out with your custom config and a niche-of-niches browser.
I don't know if this is done by default, but this is dangerous to do. A disabled canvas is itself a fingerprint, and can be more unique than your original fingerprint [1]. Canvas randomizers can have the same issues if they are not done properly. From what I've heard, the best mitigation is Firefox's `resistFingerprinting` flag, since it uses the same methods as Tor browser
[1]: https://multilogin.com/how-canvas-fingerprint-blockers-make-...
However I agree that privacy.resistFingerprinting is probably the way to go.
Perhaps, but not many people in your area run the latest version of Firefox while not supporting WebGL and having a display with a high DPI (for example).
Not really. Even my decade+ old laptop supports webgl on both firefox and chrome.
[1]: https://multilogin.com/the-great-myth-of-canvas-fingerprinti...
um... what'd i miss? Why would i want this?
I don't agree that disabling IPv6 improves privacy, but there is some foundation for the idea.
Now you have to have all sorts of elaborate mechanisms like STUN, etc. to find a third server to coordinate handshaking so video chat can work, sometimes necessary to be relayed through the third server instead of directly between the two clients.
I remember reading about one or more web browsers dropping FTP support entirely not very long ago. Sic transit gloria mundi.
EDIT: Just in case it is not clear, I wholeheartedly agree with you!
Are privacy address per machine or per connection? My impression is that they're the former, which still makes them worse than IPV4 + NAT.
More than a few. RFC 3041 was published in January 2001.
Stable-Privacy is just like having an IPv4, but if your prefix changes the suffix changes, so you can't be easily traced across prefix changes. For desktops, normal privacy should be configured.
Sounds like it's still worse than IPV4 + NAT, because your address + port tuple changes with each connection, whereas with ipv6 it's the same across connections for 10 minutes.
I'll admit, I haven't done due-diligence on any of the folks at Mozilla, but I think it'd be a lot easier to socially engineer a project like LibreWolf than Firefox.
Edit: I'll add I mean no disrespect to the folks at LibreWolf, in fact it's awesome what they're doing. I just find it hard to take most things at face value these days, especially a browser.
"It can die some day" - everything does.
I can't say my logic is without holes, for example I don't do much to verify my trust in Mozilla, but you have to make generalizations in this field or you would never get anything done.
[1] If you need a real-world example, see Anom.
LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=30720301 - March 2022 (217 comments)
LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=29106155 - Nov 2021 (306 comments)
LibreWolf: A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=26034774 - Feb 2021 (1 comment)
LibreWolf – A fork of Firefox, focused on privacy, security and freedom - https://news.ycombinator.com/item?id=23901130 - July 2020 (5 comments)
It sure looks interesting but that article definitely burst some of my privacy bubbles...
The biggest improvement for me? On macOS, I can control upgrades myself via homebrew. No more popups every day begging me to update. It became really annoying that Dev Edition uses the same release cadence as Nightly, so you basically have a new update available all the time. And now vanilla Firefox doesn't even let you disable update checks.
I also sometimes use Mull on Android. Its nice that there's some variety these days, even if they're just config differences.
Choice is nice.
Guess they don't care about supporting privacy other than skimming off of work of google all the while lambasting their efforts of destroying the same privacy policies they believe they are protecting.
Eh, fuck'em